Comments on: TimThumb.php Vulnerability Scans /2011/09/09/timthumb-php-vulnerability-scans/ Tips and tricks to get technology to work for you, by Michael Boyd Clark Sat, 20 Feb 2016 14:14:51 +0000 hourly 1 By: JeffM /2011/09/09/timthumb-php-vulnerability-scans/comment-page-1/#comment-20407 Wed, 21 Sep 2011 14:04:48 +0000 http://www.planetmike.com/?p=1468#comment-20407 I also started getting hit by these scans about a month ago. It began with /wp-content/plugins scans, and this week it’s targetting /wp-content/themes.

It’s looking for other scripts too, like thumb.php, cropper.php, img.php and getimg.php.
My site doesn’t host any of those scripts, but when it gets scanned I notice there’s always a ‘blank’ referrer in the request. I’d have expected a referrer, at least.

This .htaccess rule is working fine for me:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} ^-?$ # if referrer empty (or faked empty)
RewriteCond %{REQUEST_URI} ((tim)?thumb|cropper|img|getimg)\.php$ [NC] # deny the request
RewriteRule .* – [F]

It catches all IPs (present and future, hopefully). I’ve tried a 301 back to the REMOTE_ADDRESS but it made no diff, they just keep coming.

]]>